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Topic 


Annual Report and Financial Statements 2020/21 - Lessons 
Learned 


Objective of this report 


The objective of this report is to give the Audit and Risk Committee 
assurance of the lessons learned from the production of the 
2020/21 Annual Report and Financial Statements and identify the 
improvements to the process for future years. 


Recommendation 
That the Audit and Risk Committee notes the report. 
Lessons learned 


Following completion of the Annual Report and Financial 
Statements for 2020/21, we held lessons learned meetings during 
August and September 2021, to capture any improvements that 
we can identify to the process for future years. These meetings 
were both internal (between Corporate Governance, Finance and 
Communications) and external (with the NAO). 


The following lessons learned were identified, along with actions to 
implement the lessons: 


Lessons learned between the ICO and NAO 


Lesson 1: lack of clarity regarding whether a trust statement 
should or could be produced. 


Action 1: a report is provided to the Committee elsewhere on the 
agenda for this to clarify the position on whether a trust statement 
will be produced for the 2021/22 Annual Report and Financial 
Statements. 
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Lesson 2: the audit completion report identified a non-material 
adjustment on the expected credit losses on fines and penalties. 


Action 2: ICO Finance team will provide further information to NAO 
and Deloitte at an earlier stage, particularly on the risk 
assessments on the organisations involved in fines and penalties 
and the overall economic environment, which informs the 
provisions for losses in this area. 


Lesson 3: the ICO sometimes lacked clarity on some amendments 
required by BDO or NAO, in some cases with contradictory 
amendments being suggested. 


Action 3: NAO have clarified that they will always retain overall 
responsibility for the audit. They will ensure that the timing of any 
file reviews ensures any amendments are shared clearly and a 
timely manner. This has been taken into account in the NAO’s 
appointment of Deloitte to undertake the delivery of the audit 
(under contract for a minimum of three years). 


Lesson 4: there were significant benefits to bringing forward the 
timeline for production of the report. ET agreed the scope in 
January, Communications began drafting the narrative for the 
performance report, based on approved copy from stories on the 
website, during February and March with the report substantially 
completed in April (apart from any information which was not 
available at that time, e.g. audited financial figures). This meant 
that the near-final report could be presented to Management Board 
in May 2021 for approval, which was provided to BDO during their 
audit fieldwork. In particular, initial drafting of the performance 
report by the Communications Directorate led to a high quality first 
draft using significantly less resources. 


Action 4: repeat the process for production of the report in 
2021/22. 


Lesson 5: we established weekly progress meetings involving 
Corporate Governance, Comms and Finance throughout the 
process, along with a Gantt chart progress tracker, following the 
lessons learned from last year’s report. The meetings typically 
lasted less than 15 minutes but the meetings and tracker had 
significant benefits in keeping all parties aware of progress or 
problems. 


Action 5: continue with weekly progress meetings and Gantt chart 
progress tracker for 2021/22. 
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4.3. 


4.4. 


Lesson 6: Corporate governance were involved in the audit end-of- 
fieldwork meetings with the external auditors. This allowed us to 
be aware of progress and any potential issues which could impact 
the sign-off date for the accounts. 


Action 6: continue with Corporate Governance attending end-of- 
fieldwork meetings with external auditors. 


In addition, there is also the consideration that, for the 2021/22 
Annual Report and Financial Statements, there will be a new 
Commissioner in post, meaning the ICO has a new Accounting 
Officer. The NAO’s recommendation where there is a change in 
Accounting Officer is that there should be a handover between the 
outgoing Accounting Officer and the incoming one, in accordance 
with the principles set out in Managing Public Money and other 
HMT guidance). This could take the form of a meeting, a pack of 
information prepared by officers and signed off by the Accounting 
Officer, or a combination of both. This allows the outgoing 
Accounting Officer to give the new person assurances that there 
are no areas of concern regarding the finances or governance of 
the organisation. We will ensure that this is picked up within the 
handover from the current Commissioner to the new 
Commissioner. This risk is mitigated somewhat as there will be 
continuity of Paul Arnold remaining in his role as Accountable 
Officer. 


There are also a few other new considerations that we have 
identified for the 2021/22 Annual Report and Financial Statements: 
the updated depreciation policy (subject to the Committee’s 
decision on the report elsewhere on the agenda); the appointment 
of new auditors (Deloitte) to conduct the audit on the NAO’s 
behalf; and the appointment of the ICO’s new Finance Director, 
who will begin their role later this month. We will ensure that as 
part of the audit planning process we build up strong relationships 
between the ICO, Deloitte and NAO, and the new depreciation 
policy (if approved) will be a point of emphasis in the planning for 
the 2021/22 audit. 


Consultation outcomes 


We developed these lessons learned collaboratively with the NAO, 
which has led to identifying a wide range of lessons learned and 
actions to address them. 
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6. Publication decision 


6.1. This report can be published internally and externally without 
redactions. 


Author: Chris Braithwaite 


Consultees: Louise Byers, Robert Buysman, Dave Murphy, Ian 
Greatorex, Diana Rutkowski 
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